CVE-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through G...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"13.3.0"},{"fixed":"13.3.9"},{"introduced":"13.4.0"},{"fixed":"13.4.5"},{"introduced":"13.5.0"},{"fixed":"13.5.2"}]}]

参照URL

advisory gitlab.com
advisory hackerone.com
web gitlab.com
web nvd.nist.gov